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Abstract. We present an improved protocol for entanglement purification of 
bipartite mixed states using several states at a time rather than two at a time 
as in the traditional recurrence method. We also present a generalization of 
the hashing method to n-partite cat states, which achieves a finite yield of 
pure cat states for any desired fidelity. Our results are compared to previous 
protocols. 



1. Introduction 

Entanglement is a fundamental resource in quantum information. It can be used 
for secure quantum cryptography |Q and is an essential part of known algorithms for 
quantum computation J2], ^] (strangely, it is not known that all quantum algorithms 
which outperform their classical counterparts require entanglement. See [Q for a 
situation in which quantum states display a form of nonlocality, but which involves 
no entanglement). 

Early studies of entanglement purification |^,J0| focused mainly on bipartite 
entanglement, attempting to distill pure EPR pairs |8| from bipartite mixed states. 
More recently, Murao, Plenio, Popescu, Vedral and Knight JJ have studied the 



generalization of such schemes to distilling three-party (GHZ [10]) and multi-party 
states of the form (sometimes called "cat" states ) 



(i) |$+> = -L(|oo...o> + |ii...i>) 

from three-party and multi-party entangled mixed states. However, they do not 
study generalizations of the hashing method of |Q. The hashing scheme has the 
major advantage over the recurrence style scheme of that it achieves a finite 
yield of pure cat states for any arbitrarily high fidelity, whereas the yield for any 
recurrence method goes to zero. 

In this paper we study an improved purification protocol for two parties, and 
a generalization of hashing to multiple parties. 

First, we define some notation: All of our studies will apply to entangled mixed 
qubit states of N parties (conventionally known as Alice, Bob, etc.), diagonal in 
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the following basis: 

|0ii« 2 ■ ■ • iN-i) + (-l) p |l«i«2 ■ ■ • ijv-i) 



( 2 ) I^P.iii 



V2 



where p and the i's are zero or one, and a bar over a bit value indicates its logical 
negation. This gives 2 N orthogonal states. 

These states correspond to the simultaneous eigenvectors of the following op- 
erators (There are N operators in all, one special one of the X form, and N — 1 
involving Z and I): 
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The X, Z, and I operators, along with the Y operator which we don't use here, 
are members of the Pauli group (for more details, see fl^| ). The p from Equation 
(||) corresponds to whether a state is a +1 or —1 eigenvector of So (p — for a +1 
eigenvector and p = 1 for a — 1 eigenvector). This is called the "phase" bit of the 
cat state. The ijS correspond to whether a state is a +1 or —1 eigenvector of Sj 
for j = 1, . . . , (N — 1), which we call the amplitude bits. Thus, the following is the 
set of generators of the stabilizer group of IVWi^- ..ijv-i) : 

(4) {(-i) p s , (-irsi, . . . , i-iy^SN-t} 

It is important to realize at this point that since these operators are all tensor 
products of operators on the subsystems 1 ... N each with eigenvalue ±1, they can 
be measured using only local quantum operations plus classical communication. If 
an unknown one of the i/>'s is shared among N parties and they wish to determine 
the eigenvalue corresponding to one of the Si, each party just measures his or 
her operator and reports the result to everyone else. The eigenvalue of the whole 
operator is the product of their individual results. Furthermore, since Z and / 
commute, it is possible to measure the eigenvalues of all the S^q. On the other 
hand, X and Z do not commute and therefore if Sq is measured, none of the <Sj>o 
can be measured (a random result would occur) and similarly if any of the Si>o 
are measured the result of an So measurement will be randomized. In other words, 
the parties can locally measure either all the amplitude bits or the phase bit for an 
unknown cat state. 

The other tool we will need is the multilateral quantum XOR gate, in which 
each party's bits are XORed together in a quantum-coherent way (see Fig. Q). 
Following Gottesman |l2| we can work out how a tensor product of two cat states 
behaves under the multilateral XOR. The generators of the stabilizer group behave 
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Figure 1 . The multi-party XOR. 



as follows under the quantum XOR operation: 



(5) 



X®I -> x®x 

I®X -> 7(g)X 
Z®7^ Zg>7 
7® Z -> Z® Z 



We work out here the case of three parties, the generalization to n-partite cat 
states will be apparent. Given IVv.u^) an d IVWu'2) w ith stabilizers as in Eq. 
the generators of the stabilizers of the tensor product of these are given by: 



(6) 



{{-lyxxxiu, (-ly^zzini, (-lpzizin, 
(-lynixxx, (-i)^iiizzi, (-iy*iiiziz} 



(We have omitted the £g> symbol for brevity.) Now, applying the rule for the XOR 
operation (0) to corresponding operators (the first and fourth positions correspond 
to the first party's piece of iV^tita) and \ijjq,j 1 j 2 ) respectively, etc.) we get: 



(7) 



{(-iyxxxxxx, {-if^zziiii, (-iy*zizin, 
(-lynixxx, (-ly^zzizzi, (-iy*zizziz] 



We can easily find another set of generators for the same stabilizer group which 
is again the tensor form of (@): 
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, . {(-1)P+1XXXIII, {-lf^ZZIIII, (-l) i2 ZIZIII, 

^ > 1 (-lyinxxx, (-i) ii+ ^iiizzi, {-i) i2+ ^inziz} 

This is simply the set of generators corresponding to iVVeq,*^) ® l^g.ueji ^e^)- 
What has happened is that the phase bits have been XORed together with the result 
put into the phase bit of the source state and the amplitudes are each XORed to- 
gether and stored in the target state's amplitude bits. This suggests that the action 
of the multilateral quantum XOR gate (MXOR) can be characterized by its action 
on the purely classical representation of states as a set of bits, (p, i\, 12, ■ ■ ■ , iN-i)'- 

(9) MXOR[0,zi,i 2 , . . . ,ijv_i),(g,ji,j 2 ,... ,j N -i)] = 

(p®q,i 1 ,i 2 ,--- ,iN-i),{q,h® ji,i2® h,--- , iN-i ® jiv-i) 

Due to its linearity quantum mechanics allows us to think of mixed states as if 
they are really one of the pure states in the mixture but that we are simply lacking 
the knowledge of which one (if the states in the mixture come with unequal prob- 
ability, we are not completely lacking knowledge of which state is in the mixture, 
but we only know the probabilities, not which state we actually have). Since all 
the cat states (||) are interconvertible by local operations |fl3| if we had a mixture 
of cat states and could determine which one we actually had, we would be able to 
convert it to a |$ + ) and would have purified the mixture. 

Putting everything we have said up to now together lets us find purification 
schemes that are essentially classical; only the rules of what we can do are given by 
quantum mechanics: 

• Mixed states diagonal in the cat basis can be thought of as being simply 
unknown members of the set of cat states. 

• The cat states (j|) are all interconvertible by local operations, so determining 
which cat state one has is sufficient to have purified it. 

• Either the p or all the i's of an unknown cat state may be measured by local 
operations plus classical communication. 

• The multilateral XOR operation operates classically on the ps and i's of 
pairs of cat states according to Eq. (|Io|). 

Our purification schemes will thus work by treating a set of many mixed states 
(which are diagonal in the cat basis) as a set of unknown cat states, and attempting 
to determine the unknown states, discarding them if we cannot. 

We are now prepared to analyze the efficiencies of various entanglement pu- 
rification protocols applied to mixed states. In particular, we concentrate on the 



generalization of the Werner state [14 



1 — a 

(10) p w = a\$+)($ + \ + -y r l, 0<a<l 

The fidelity of pw relative to the desired pure state |$ + ) is F — 
a + ^rr- ■ We rewrite pw in the cat basis ^ as 

1 — a , 



(11) Pw = (a + N )|'0o,oo...o)(V'o,oo...o| 



2_/v ^ ] |'0p,iii2...'ijv-i)(V J P,ni 
p, ii 12 ...ijv-i 7^0,00... 
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Thus, the Werner state is diagonal in the cat basis and we can think of it as really 
being one of the cat states. We write the unknown cat states as N unknown strings 
of bits: bo,bi,b2, ■ ■ ■ ,6jv_i, where 60 is formed by concatenating the (unknown) 
phase bits of all the cat states, and the bj for j > are formed by concatenating 
the jth amplitude bits. Together the bj make up the total bitstring B. 

2. Bipartite Protocol 

The case of two parties has been studied |6|, fr|. The protocols can distill 
pure entanglement from any Werner state with fidelity F > 1/2. The recurrence 
methods that work on Werner states near F = 1/2 involve local quantum operations 
on two mixed states at a time. For high fidelities, the best known strategy (the 
hashing method) obtains high yields in the limit of arbitrarily large numbers of 
states. It seemed that operations on an intermediate number of mixed states might 
give better yield for intermediate fidelities, and this turns out to be the case. 
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Figure 2 . The sequence of XOR gates and final measurement in 
the z basis for our bipartite strategy for m = 4. 



Our new strategy is to choose a block size m and to take m — 1 Werner states 
and do a bipartite XOR between each one and an mth Werner state, and then to 
measure the amplitude bits of that target state. The sequence of XORs is illustrated 
in Fig. U for the m = 4 case. This is a natural generalization of the recurrence 
method whose single step is just this method for m = 2. If any amplitude bit 
is nonzero, the two measurements disagree, the source states are discarded. If all 
amplitude bits are zero the states are said to have "passed" and the hashing method 
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is performed on the m — 1 source states along with other source states that passed. 
The advantage over the m = 2 recurrence is that fewer than half the mixed states 
are used up inherently just by being measured targets. 

In H the hashing method was used only on states whose mixture probabilities 
were independent. We note that hashing is a quite general method for extracting 
entropy from strings of bits, even if there are correlations among the bits. One 
merely needs to take as many hash bits as there is entropy in the bitstring. Thus, 
the yield of our method is: 

. . m — 1 / H (passed source states) \ 

(12) Ppass 1 : 

m \ m—1 / 

The calculation of the entropy of a block of passed states and of p pass is straightfor- 
ward. One simply keeps track of the probability of each possible string B (of 2mN 
bits corresponding to a block of m Werner states) given the probabilities in the 
Werner mixture ([l2|), applies the MXOR rule (|l0|) to B to yield a B' and groups 
the like B's which have passed to yield a final distribution Pj (of the 2(m — 1)N 
bits corresponding m—1 states left after the MXOR operation). We then have 
Ppass = Yli Pi an d the normalized distribution P- = Pi /p pass and the entropy 
H (passed source states) given by — J2 i P- log 2 P/. 

Figure compares the yield for our new method for various values of m with 
the previous recurrence continued by hashing protocol. We have not found a simple 
way to analyze what happens if our multi-bit step is iterated, rather than passing 
on immediately to hashing. For the m = 2 recurrence only one passed source state 
remains and it is identical in all respects to every other passed source state. For 
m > 2 there are multiple correlated passed states and it is not clear just how to 
treat them. For instance, at m = 3 there are two passed states from each operation 
and there is no way to combine the 4 passed states from two operations into another 
m = 3 step. 

3. Multipartite Hashing 

In Q multi-party recurrence methods are studied, but not multi-party hashing 
which is needed to achieve finite yields. Here we present a multi-party hashing 
method. 

In the case of two parties it is known Q how to extract the parity of any 
random subset of all the bits in B. For more than two parties it is not known now 
to do this. Instead, we can choose to extract any random subset parity on either 
the parity bitstring bo or on all the amplitude bitstrings bj, j > in parallel. This 
follows immediately from Eq. ([!(]): This is done multilaterally XORing together 
all the states in the desired subset choosing one of them to be the target. See Fig. 
[|. Depending on the direction of the XOR gates either the phase bits or all the 
amplitude bits accumulate in the target state, which can then be measured. 

Our multilateral hashing protocol will be to choose a large block size m and 
then to extract mmaxj >0 [{H(bj)}] random subsets of each amplitude bitstring in 
parallel (as shown in Figure |Ja), where H(bj) is the entropy per bit in string bj. 
This is sufficient to determine all the bits of all the bj>o as it is just doing the same 
random hash on each bitstring. Even though the random hashes are all the same, 
since they are uncorrelated with the bitstrings being determined this many hash 



bits will be enough to determine all bits of the bj > o [ 15 |. This procedure actually 



extracts too much information (and thereby uses up too many states as measured 
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Figure 3. Yields of various bipartite purification protocols. The 
thick line is the recurrence continued by hashing method, the 
dashed line is our new method for m = 3, solid for m = 4 and 
dotted for m = 5. The shaded region is the region where our new 
method improves on the recurrence/hashing method. Note that 
yield for m — 5 is never the best, though for some fidelities it is 
better than the recurrence/hashing method. The m — 6 case (not 
shown) behaves similarly, while for m > 6 the new method is al- 
ways worse than recurrence/hashing. The sharp "knee" visible in 
the recurrence/hashing line is the point above which recurrence is 
never used and hashing is done immediately. 



targets), so perhaps a more efficient protocol exists, but this has the virtue of using 
only the multilateral XOR operation which maps cat states to cat states. After 
determining the amplitude bits, to find bo we use multilateral XORs arranged as in 
Fig. ||b, and find the hash of the string by measuring another H(bo) of the states. 
The yield of this hashing protocol is given by 



(13) 



D h = (1 - max[{H(bj)}} - H(b )) 

j>0 



For the case of Werner states all the 6's have the same entropy and Eq. (13) 
reduces to 



(14) 
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Figure 4. Multi-party hashing: These hashes are done on large 
blocks of bits (indicated by the vertical ellipsis) and are done mul- 
tilaterally (only one party's operations are shown, the other N — 1 
parties operations are identical). 

a) Finding a random subset parity on all the &j>o in parallel. In 
this case the first, third, sixth and seventh states shown are XORed 
multilaterally into the last one which is then measured to deter- 
mine the eigenvalue of the Z operator. 

b) Finding a random subset parity on bo. In this instance the par- 
ity of the first, second, fourth and eighth states shown are XORed 
with the last one, which is then measured in the eigenbasis of the 
X operator. Note the reversal of the direction of the XOR gates 
with respect to a). 



or in the limit as the number of parties goes to infinity 
(15) D^ = \-2hJ ' ' 



where H 2 {x) — —x log 2 x — (1 — x) log 2 (1 — x). Eq. 14 is graphed for several values 
of N in Figure |5|. By using the recurrence method and switching to hashing as soon 
as it gives better yield, one can obtain positive final yield to arbitrarily high fidelity 
for any initial fidelity for which the recurrence method of Q improves the fidelity. 

4. Conclusions and Comments 

We have found improved bipartite recurrence protocols for the purification of 
entanglement from mixed quantum states. We have also demonstrated the first 
finite-yield method for purification of cat states in a multi-party setting. It is 
worthwhile to note that both of these new procedures were analyzed for mixed 
state diagonal in the cat basis, but that in fact they will work for any mixed 
state just as well, by considering the state's cat-basis diagonal elements. This is 
unlikely to be the optimally efficient strategy for non-diagonal states however. In 
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Figure 5. Yields for multipartite hashing for various numbers of 
parties. The solid line is the two-party hashing method of Q. 
The dotted line is the corresponding N = 2 version of our new 
hashing method, which has a lower yield since it works on the 
amplitude and phase bits as separate hash strings even though 
for the bipartite case it is known how to extract their entropy 
together, which is more efficient. The lines consisting of dashes, 
longer dashes and dots with dashes are the N — 3, N — 4, and 
N = oo cases respectively. 



there is an example of a state for which the conventional bipartite recurrence and 
hashing cannot distill any pure entanglement, but which can nevertheless simply be 
distilled. One expects such examples to exist for our new methods as well (indeed, 
the example in ^| is an example for the bipartite case of new methods which will 
similarly fail to distill it. 

For our bipartite protocol, while clearly not optimal it is not so bad to have 
passed over to hashing instead of recurring the protocol. Recurrence methods 
have vanishing yield if one desires arbitrarily high fidelity of the purified states, 
so hashing needs to be used eventually in any case. Additionally it would likely 
be best to produce a variable block size protocol that begins as the recurrence 
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method for low fidelity, switches to a larger block size at some higher fidelity and 
finally is continued by hashing. A calculation of the yield of such a method is 
cumbersome, and seemingly provides little insight. We hope that our having pointed 
out that block size m > 2 methods can improve over recurrence will stimulate 
further work in this area to develop a deeper understanding, rather than just a 
brute-force analysis. Much progress has been made on purification involving only 
one-way classical communication. Such protocols directly correspond to quantum 
error-correcting codes (cf. Q) but recurrence protocols inherently involve two-way 
classical communication so all parties know which states to discard. So far little 
of the coding theory has been applied to this case. There does appear to be some 
relation between these two-way purification protocols and quantum error-detecting 



codes, and some progress is being made in this area [16| 
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